1. What happened
On October 29, 2026, NAS maker Synology announced from Taipei that it had identified attackers exploiting a vulnerability patched in December 2024 to hit devices running outdated versions of DSM, encrypting data to demand a ransom. It urged all users to update DSM immediately and recommended turning on automatic updates (Synology announcement).
The official advisory the announcement points to, Synology-SA-24:20, was published on November 5, 2024 and rated Critical. One of its three flaws, CVE-2024-10441 (CVSS 9.8), lets a remote attacker execute arbitrary code. The fixed releases are 7.2.2-72806-1 or later for DSM 7.2.2, 7.2.1-69057-6 for 7.2.1, 7.2-64570-4 for 7.2 and 7.1.1-42962-7 for 7.1, and the advisory lists no mitigation (Synology-SA-24:20).
BleepingComputer reports that Synology has not said which vulnerability is being exploited; it linked to its November 2024 advisory. The outlet advises users to block internet access to the DSM management interface and to update DSM. Victims are shown a ransom note telling them to buy a decryption tool called C3rb3r Decryptor from a dark web page for thousands of dollars, it says, and it adds that the last time Synology issued an alert about attacks on its customers was August 2019 (BleepingComputer). Victims had been posting about it on the BleepingComputer forum since October 17 (forum thread).
2. Why it matters to small firms
According to BleepingComputer, the research group Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, though the outlet notes that it cannot tell how many are already patched or are honeypots (BleepingComputer). The number is only indicative, but Synology's own announcement confirms the pattern: devices left exposed on outdated DSM are the ones being targeted.
A NAS is often where a small office keeps quotations, customer lists, order data and backups. It is not unusual for the management screen to have been opened to the internet so staff can reach files from home or on trips, and for nobody to have updated it since the person who set it up left. The fix came out in 2024, so a device that was never updated has been running with a publicly known flaw for about two years.
Our view We think the companies in danger are those whose only backup sits on the same NAS. Once the data is encrypted, the backup goes with it, and the choice becomes paying thousands of dollars as the note demands or losing the transaction records, with no guarantee that paying restores anything. Preventing this costs a check of the DSM version and the work of keeping one more copy outside the NAS. Check the DSM version, and whether the management screen is reachable from the internet, this week.
3. What to check now
- List the Synology NAS units in your office, warehouse or home, and who looks after each one
- Check in the management screen that DSM is at or beyond the SA-24:20 fixed releases (7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8)
- If it is older, confirm a recent backup exists somewhere other than the NAS (another device or the cloud) before updating
- Check your router settings to see whether the management screen is reachable from the internet, and move access behind a VPN if it is needed
- Turn on DSM automatic updates and point notifications at a shared address that survives staff turnover
Our outlook
Over the next six months to two years, we expect attacks that build on two-year-old advisories to concentrate on devices that were installed and forgotten, such as NAS units and routers. Over the same period, business partners will ask more often where quotations and customer data are kept, and companies that cannot explain how their devices are managed will face tighter terms. Companies that keep an inventory of devices, a named person for updates and a backup outside the NAS can get back to work in days after an incident. Now is the time to lay the groundwork: build the inventory this month, name an owner for each device, and set up a routine in which AI and a maintenance contact watch for new advisories and apply updates within days of release.
Questions this article answers
I heard Synology NAS devices are being hit by ransomware. What should I do?
On October 29, 2026, Synology said it had seen attacks exploiting a vulnerability patched in December 2024 and urged an immediate DSM update. Check the DSM version in the management screen; if it is older than the SA-24:20 fixed releases, confirm a backup exists outside the NAS and then update. Synology also recommends enabling automatic updates.
Is it safe to leave the NAS management screen open to the internet?
It is not safe. BleepingComputer advises users both to update DSM and to block internet access to the management interface. If you need access from outside the office, moving it behind a VPN is the usual approach.
Sources
- Synology: Synology urges users to update DSM following ransomware attacks on outdated DSM versions (2026-10-29)synology.com
- Synology: Synology-SA-24:20 DSM (PWN2OWN 2024)synology.com
- BleepingComputer: Synology warns of C3RB3R ransomware attacks targeting NAS devicesbleepingcomputer.com
- BleepingComputer Forums: C3RB3R ransomware encrypting NAS devices (*.L0CK3D extension / read-me3.txt)bleepingcomputer.com
Related Q&A
Related services
If you want to try this in your own business
To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.